LoFP / legitimate account decommissioning or cost-reduction exercises may disable security hub in unused regions. validate with the responsible team via change management records before escalating. disabling in the primary account region or the security hub delegated administrator account is always high-risk.

Techniques

• T1562

Sample rules

AWS Security Hub Disabled

• source: elastic
• technicques:
  • T1562

Description

Detects when AWS Security Hub is disabled in a region. Security Hub aggregates security findings from AWS services (GuardDuty, Inspector, Macie, IAM Access Analyzer) and third-party tools into a single pane of glass. Disabling it suppresses centralized finding aggregation and compliance checks, removing visibility into threats across the account. This action is a documented pre-ransomware and pre-exfiltration defense evasion technique.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "securityhub.amazonaws.com"
    and event.action: "DisableSecurityHub"
    and event.outcome: "success"